Page control permission testing method and device
By building a structured matrix of role-control-permission triples and an isolated testing environment, automatically detecting page control permissions, and combining front-end and back-end verification mechanisms, we solve the problems of coarse-grained permission verification and pseudo-front-end control in Web applications, and achieve more fine-grained permission testing and security verification.
Patent Information
- Application Number
- CN202510906154.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-01
- Publication Date
- 2025-10-03
AI Technical Summary
In existing Web application security testing, the permission verification granularity is coarse, which cannot guarantee the reliability of permission control and cannot detect the security risks of pseudo front-end control. In addition, the existing methods have surface verification problems.
By building a structured control permission matrix of role-control-permission triples, creating an isolated test environment, automatically logging in to user roles, locating and detecting the permissions of page controls, and combining the front-end and back-end two-way verification mechanism, active security penetration testing is performed.
It implements more fine-grained testing of page control permissions, improves test efficiency and reliability, ensures independent verification of page controls, implements independent verification of the operation permissions of each page control, ensures independent verification of the operation permissions of each page control, and ensures the reliability and security of permission control.
Smart Images
Figure CN120744934A_ABST
Abstract
Claims
1. A page control authority testing method, characterized in that: The method comprises: Start the test engine to load the permission configuration table in the user requirement document, parse the permission configuration table, and generate a structured control permission matrix. The control permission matrix includes: role-control-permission triple relationship; Build an isolated test environment; Automatically log in to the user role account and load each page to be tested in sequence; After each page to be tested is loaded, a target control on the page to be tested is located according to the control information in the control permission matrix, and a permission test is performed on the target control to obtain a test result.
2. The page control authority testing method according to claim 1, characterized in that: The construction of the isolated test environment includes: Create an independent browser instance based on the Chromium kernel and configure the incognito mode; Deploy a network proxy module to monitor all test traffic and flag tampered requests.
3. The page control authority testing method according to claim 1, characterized in that: The automatic login of the user role account and sequentially loading each page to be tested includes: The automated test script launches the browser and navigates to the set login URL; Obtaining user account and password information from a configuration file based on the user role, and logging in using the user account and password information; After successful login, navigate to the page to be tested and load the page to be tested.
4. The page control authority testing method according to claim 1, characterized in that: The step of locating the target control on the page to be tested according to the control information in the control permission matrix includes: Determine the corresponding label on the page to be tested according to the control identifier provided in the permission configuration table <label> element;< / label> Get the tag <label> The for attribute of the element;< / label> The target control on the page to be tested is located according to the for attribute.
5. The page control authority testing method according to claim 4, characterized in that: The step of locating the target control on the page to be tested according to the control information in the control permission matrix further includes: The dynamic target control on the page to be tested is located by combining the control identifier, XPath axis and metadata; the dynamic target control includes any one or more of the following: an input box, a text area, and a selection box.
6. The page control authority testing method according to claim 1, characterized in that: The performing of permission detection on the target control to obtain the detection result includes: Perform any one or more of the following tests on the target control: basic attribute test, visual state test, event interception test, and obtain test results; If the detection result is failure, the corresponding path, current user role, expected permissions, and actual permissions are recorded.
7. The page control authority testing method according to claim 6, characterized in that: Performing basic property detection on the target control includes: Obtaining basic properties of the target control, and detecting whether the permissions of the basic properties are consistent with the permissions specified in the user requirement document; Performing visual state detection on the target control includes: Capturing the target control's visible area image through the browser, the target control's visible area image refers to the image presented by the current browser window, including the target control itself and its surrounding elements; Comparing the image of the target control's visible area with the expected display image, calculating a structural similarity index between the actual image and the reference image, and determining that the visual state is abnormal when the value of the structural similarity index is lower than a set threshold; Performing event interception detection on the target control includes: Using the browser debugging interface to obtain the event listener list bound to the target control; Check whether there is permission verification information in the event listener list.
8. The page control authority testing method according to claim 1, characterized in that: There are multiple user role accounts; the method further includes: After completing the permission test of all pages to be tested by logging in with the current user role account, the next user role account is automatically logged in to perform the permission test of all pages to be tested until all accounts are logged in to complete the permission test.
9. The page control authority testing method according to any one of claims 1 to 8, characterized in that: The method further comprises: If the permission detection result of the target control is successful, then actively perform security penetration testing on the target control to obtain a test result; After the test is completed, the tampered properties are automatically rolled back to the original state.
10. The page control authority testing method according to claim 9, characterized in that: The active security penetration test on the target control includes: Tampering with the properties of the target control and performing unauthorized operations; the unauthorized operations include at least one of the following types of unauthorized behavior: data tampering operations, unauthorized access operations, permission escalation operations, and data injection operations; Detect whether the unauthorized operation causes the state of the target control to be abnormal, and obtain the response information returned by the interface corresponding to the unauthorized operation; the response information includes any one or more of the following: response status code, security header and error message body, and validity of permission verification logic; The response information is compared with the database snapshot to determine whether the unauthorized operation results in data changes.
11. The page control authority testing method according to claim 10, characterized in that: The method further comprises: Summarize the execution status of all test cases and generate a test report; the test report includes any one or more of the following information: (1) Permission consistency summary: Statistics on the number of passed and failed test cases and defect distribution by role, page, and control type; (2) Security penetration conclusion: List the vulnerability controls that can bypass front-end restrictions and their risk levels. The risk levels are divided into four levels: severe, high risk, medium risk, and low risk; (3) Repair suggestions: Recommend reinforcement solutions based on the vulnerability type.
12. A page control authority testing device, characterized in that: The device comprises: The test engine is used to load the permission configuration table in the user requirement document, parse the permission configuration table, and generate a structured control permission matrix, wherein the control permission matrix includes a role-control-permission triple relationship; Environment setting module, used to build an isolated test environment; Navigation module, used to automatically log in to the user role account and load each page to be tested in sequence; The detection module is used to locate the target control on the page to be tested according to the control information in the control permission matrix after each page to be tested is loaded, perform permission detection on the target control, and obtain a detection result.
13. The page control authority testing device according to claim 12, characterized in that: The detection module includes: a positioning unit and any one of the following detection units: a basic attribute detection unit, a visual state detection unit, and an event interception detection unit; The positioning unit is used to locate the target control on the page to be tested according to the control information in the control permission matrix after each page to be tested is loaded; The basic property detection unit is used to perform basic property detection on the target control to obtain a detection result; The visual state detection unit is used to perform visual state detection on the target control; The event interception detection unit is used to perform event interception detection on the target control.
14. The page control authority testing device according to claim 13, characterized in that: The device further comprises: The security penetration testing module is used to perform active security penetration testing on the target control to obtain the test results when the permission detection result of the detection module is successful; after the test is completed, the tampered attributes are automatically rolled back to the original state.
15. The page control authority testing device according to claim 14, characterized in that: The security penetration testing module includes: An operation execution unit, configured to tamper with the properties of the target control and perform unauthorized operations; the unauthorized operations include at least one of the following unauthorized behaviors: data tampering operations, unauthorized access operations, permission escalation operations, and data injection operations; A front-end detection unit, configured to detect whether the unauthorized operation causes the state of the target control to be abnormal; The server-side detection unit is used to obtain the response information returned by the interface corresponding to the unauthorized operation; the response information includes any one or more of the following: a response status code, a security header and an error message body, and the validity of the permission verification logic; and compare the response information with the database snapshot to determine whether the unauthorized operation has caused data changes.
16. The page control authority testing device according to any one of claims 12 to 15, characterized in that: The device further comprises: The test report generation module is used to summarize the execution status of all test cases and generate a test report; the test report includes any one or more of the following information: (1) Permission consistency summary: Statistics on the number of passed and failed test cases and defect distribution by role, page, and control type; (2) Security penetration conclusion: List the vulnerability controls that can bypass front-end restrictions and their risk levels. The risk levels are divided into four levels: severe, high risk, medium risk, and low risk; (3) Repair suggestions: Recommend reinforcement solutions based on the vulnerability type.
17. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is run by a computer, the steps of the page control authority testing method according to any one of claims 1 to 11 are executed.